PT-2026-7834 · Solax · Solax Devices

Published 2026-02-12 · Updated 2026-03-20 · CVE-2025-15573

Positive Technologies (AI Summary)

CVSS v3.1

9.4

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions SolaX devices (affected versions not specified)

Description Devices do not validate the server certificate when connecting to the SolaX Cloud MQTTS server hosted in Alibaba Cloud (mqtt001.solaxcloud.com, TCP 8883). This allows attackers in a man-in-the-middle position to act as the legitimate MQTT server and issue arbitrary commands to devices. An attacker can pose as the server and issue malicious commands.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2025-15573

Affected Products

Solax Devices

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-15573 · Security Note
• https://twitter.com/CveFindCom/status/2022025786438418442 · Twitter Post
• https://twitter.com/TheHackerWire/status/2021975429687734275 · Twitter Post
• https://r.sec-consult.com/solax · Note
• https://t.me/CVEtracker/44520 · Telegram Post
• https://t.me/cveNotify/151815 · Telegram Post
• https://twitter.com/JustWantToQ1/status/2035050035860459670 · Twitter Post